CVE-2026-9977: Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148

Synopsis

Insufficient input validation in the WebShare API implementation of Google Chrome for Android (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the browser renderer process to escape the sandbox via a crafted HTML page. The attack is reachable over the network but requires the victim to visit a malicious page, and the attacker must already control the renderer, adding complexity to the exploit chain. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the browser sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome on Android.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target device must be reachable by or able to reach the attacker's server.

• AuthenticationNot required

  No account or credential is needed; any user browsing to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious ad/link a prerequisite for the attack.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must have already compromised the renderer process before this vulnerability can be leveraged for sandbox escape, requiring a multi-stage exploit chain.

Blast Radius

• Reads sensitive data accessible outside the Chrome sandbox on the Android device, including files and app data the compromised renderer would not normally reach.
• Writes or modifies files and data outside the browser sandbox, enabling persistence mechanisms or tampering with other app data on the device.
• Crashes or disrupts services and processes outside the browser sandbox, potentially destabilizing the Android system or other applications.
• Enables full code execution outside the renderer sandbox, giving the attacker a foothold in the broader Android process space.